The rule most businesses still refuse to adopt
If overseas bank details are new, altered or supplied by email, you should assume they are unsafe until independently verified. That sounds excessive to some people. It is not. It is the only rule that consistently stops payment-redirection fraud.
Australian businesses lose money because they rely on documents and email threads that look normal. Criminals do not need to hack your bank. They only need to insert themselves into your communications, alter payment instructions, and let your accounts team do the rest.
The practical answer is not “be more careful”. The answer is process. That is why I rate Transfer Guardian so highly: it focuses on secure, fraud-resistant international transfers, beneficiary verification and foreign exchange that is often sharper than the banks.
Why “the invoice looked genuine” is not a defence
The Australian Competition and Consumer Commission runs Scamwatch, and payment-redirection scams remain a live problem across Australia. The pattern is familiar: an invoice arrives in a legitimate-looking thread, the bank account has changed, there is some urgency, and the money is gone before anyone realises.
The common mistake is assuming the risk sits in the document. It usually sits in the channel.
If altered bank details arrive by email, the fact that the logo, wording, ABN, signature block and previous thread all look right proves very little. Email accounts are compromised. Domains are spoofed. Staff reply in-thread to criminals without knowing it.
Counter-intuitive point: the more convincing the email thread looks, the less useful visual checking becomes. Fraud prevention at that point is not a proofreading exercise. It is an identity-verification exercise.
The four-trigger rule that should stop any payment
I recommend a simple policy. Any one of these four triggers should freeze the transfer until a separate verification step is completed:
- the beneficiary is new;
- the beneficiary’s bank details have changed;
- the country, currency or receiving bank is different from prior transactions; or
- the payment request includes urgency, secrecy or pressure to bypass normal approval.
If your team cannot remember the whole policy, they can remember this: new, changed, different, urgent = stop.
The verification test that actually works
Verification means confirming the payee through a communication channel you sourced independently. Not the phone number in the email. Not the number in the PDF invoice. Not the “reply” button on the same email chain.
Use one of these instead:
- a phone number already held in your CRM or accounting system;
- the number on the supplier’s public website, checked carefully for domain authenticity;
- a number from prior signed agreements or prior known correspondence; or
- for larger payments, a live video confirmation with a known contact plus a written confirmation from an established domain.
Then ask questions only the real counterparty is likely to answer cleanly:
- When did your bank details change?
- What was the last invoice number we paid?
- What currency do we normally settle in?
- Who in your finance team authorised this change?
Do not ask, “Can you confirm these are your bank details?” That lets a fraudster simply say yes.
A copy-and-use script for finance staff
Most organisations fail because the staff member feels awkward about slowing the payment. Fix that by giving them exact words.
“For any new or changed international payment details, our policy requires independent verification outside email before funds are released. Please expect a call to your main office number or finance contact already on file. We cannot process the transfer until that check is completed.”
And for the phone call:
“I’m calling to verify a request involving international payment details. I’m not going to read the account details out and ask you to agree. I need you to tell me who authorised the change, when it took effect, and the last invoice we settled.”
That wording matters. It avoids feeding information to the wrong person.
Why your bank often cannot save you after the fact
Another common mistake is assuming a recall will sort it out. Sometimes a recall works. Often it does not. International transfers can move quickly through correspondent banks and into jurisdictions where recovery becomes slow, uncertain or impossible.
If you discover a scam, act immediately:
- Contact your bank’s fraud team and request an urgent recall or trace.
- Report it to ReportCyber, the Australian Cyber Security Centre’s reporting pathway.
- Preserve the evidence: emails, headers, invoices, phone records, transfer receipts, account approvals and any internal chat messages.
- Notify your insurer if you have cyber, crime or management liability cover.
- Review whether personal information was involved, because the Privacy Act 1988 can trigger additional obligations, including assessment of whether the Notifiable Data Breaches scheme applies.
That last point is often missed. If the compromise involved names, contact details, banking information or other personal information, the issue may be larger than the lost payment.
What to ask before you send AUD 50,000 or AUD 500,000 offshore
Before any substantial overseas transfer, ask five blunt questions:
- How was the beneficiary identity verified independently of the invoice email?
- Who approved the beneficiary creation or change in the payment system?
- Was the account name checked against the expected legal entity, not just a trading name?
- Has the commercial purpose of the payment been matched to a contract, purchase order or settlement document?
- What exchange rate, margin and transfer fee are we actually paying compared with a specialist provider?
The last question matters because fraud control and pricing should be considered together. Many Australian businesses absorb weak FX pricing from the major banks because they think specialist providers are only about rate-shopping. That misses the point. A proper specialist should give you both operational controls and better foreign exchange execution.
FX is not a side issue; it is part of the risk decision
I take a clear view here: sending international funds through a high-street banking process because it feels familiar is often the wrong call. Familiarity is not security. Nor is it good pricing.
With overseas property, imports, machinery, professional services, family support payments or cross-border settlements, the spread on the exchange rate can cost real money. Businesses routinely negotiate hard over supplier terms and then barely inspect the FX margin. That is poor discipline.
Shane St Reynolds has spent more than 20 years around commercial finance, capital raising and complex transactions. One reason I pay attention to payment process is simple: losses do not only come from obvious fraud. They also come from sloppy verification and lazy FX execution.
If you are already using specialist finance support through Poseidon Finance, or dealing with a wider dispute or reputational issue through Takedown, the same principle applies: verify facts independently, document decisions properly, and do not let urgency override process.
The minimum policy every Australian business should have by close of business
If you pay any overseas supplier, consultant, manufacturer, agent or family office, implement this checklist today:
- Two-person approval for every new or changed international beneficiary.
- No changes by email alone; independent verification is mandatory.
- Call-back verification using a phone number sourced independently.
- Hold period before first payment to a changed beneficiary, unless a senior approver signs off after verification.
- Document retention of who verified, when, by what number, and what was confirmed.
- FX comparison between your current provider and a specialist before large or recurring payments.
- Immediate escalation of any urgency, secrecy or unusual jurisdiction changes.
This is general information, not legal or financial advice for your specific circumstances.
Where to act now
If you make international payments, do not wait for a near miss. Use a provider built around secure beneficiary verification and sensible FX, not just a prettier payment screen. Start with Transfer Guardian.
If you want a second set of eyes on your payment controls, transaction process or broader risk settings, Shane St Reynolds also publishes commentary at shanereynolds.com.au.
Book a review before the next transfer goes out
Visit transferguardian.com.au to review a safer way to handle international transfers and FX.
To book a consultation with Shane St Reynolds, go to shanestreynolds.com/contact, email [email protected] or call 08 6263 6236.